Arista Warns VeloCloud Orchestrator Flaw CVE-2026-114625 Is Exploited in the Wild
Do Son 
TL;DR
Arista says attackers are actively exploiting CVE-2026-114625, a critical VeloCloud Orchestrator vulnerability rated CVSS 9.9. The SQL injection flaw lets any logged-in user gain “superuser operator” privileges on on-prem VCO. Fixes are available in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12.
Why It Matters
VeloCloud Orchestrator manages SD-WAN networks, so it controls traffic across many branch sites. A takeover can therefore reach far beyond one server. Arista warns that exploitation “may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.”
This is also not the first attack on VCO this year. CISA added two earlier VeloCloud Orchestrator flaws to its KEV catalog. CVE-2026-16812, an OS command injection, arrived in July. CVE-2026-93952, an input validation bug, followed in September. Both carry the same impact wording as this new advisory.
Exploited in the wild
According to the Arista Security Advisory 0199 for VeloCloud Orchestrator, the flaw “was detected by Arista and is known to be actively exploited.” Arista has already patched its hosted and dedicated VCO instances. On-prem customers must update themselves.
How the Attack Works
This VeloCloud Orchestrator vulnerability is an SQL injection flaw (CWE-89). Arista says “any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user.” That opens functions “intended for internal use only.”
The bar for attackers is low. Even a stolen read-only tenant login could become a path to full control. VCO “is exposed by default,” and the lowest built-in tenant role, Enterprise Read Only, is enough. Moreover, Arista notes that “there is no configuration that can prevent the exposure.”
Affected Versions
- VCO 5.2.x before 5.2.3.18
- VCO 6.1.x before 6.1.3.10
- VCO 6.4.x before 6.4.2.12
VeloCloud Gateway, VeloCloud Edge and Arista EOS products are not affected.
Patch and Mitigation Steps
- Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
- Contact Arista TAC if you run an unsupported release train.
- Restrict the VCO web interface to trusted admin networks.
- Block the attacker IPs 74.82.197.86 and 38.54.50.151, and search logs for them.
- Watch for unexpected outbound traffic, backdoor daemons and webshells.
- Review recent admin activity for unexpected changes.
Hunting for compromise
Arista advises checking web access logs for odd URL paths, encoded characters or high request rates. If you suspect a breach, preserve logs and file timestamps before you patch. Given active attacks on this VeloCloud Orchestrator vulnerability, admins should upgrade today.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
